Microsoft account allows users to sign into websites that support this service using a single set of credentials - these
usernames are in the same form as an
email address. Microsoft account offers a user two different methods for creating an account: •
Use an existing e-mail address: Users are able to use their own valid e-mail address to sign up for a Microsoft account. The service turns the requesting user's e-mail address into a Microsoft account ID. Users may also choose a password of their own choice. •
Sign up for a Microsoft e-mail address: Users can also sign up for a free e-mail account through Outlook.com or MSN, with Microsoft's webmail services designated
domains (i.e.
@hotmail.com,
@outlook.com,
@msn.com) that can be used as a Microsoft account to sign into other Microsoft account-enabled websites. The domains @live.com and @passport.com, as well as other domains are no longer offered, but existing accounts are maintained. Microsoft websites, services, and apps such as
Bing,
MSN and
Xbox Live use Microsoft account as a means of identifying users. There are also several other companies that use it, such as the
Hoyts website which is hosted by
NineMSN.
Windows XP and later has an option to link a local Windows user account with a Microsoft account, thus automatically logging users in to their Microsoft account whenever a service is accessed. Starting with
Windows 8 and
Windows Server 2012, Windows allows users to directly authenticate into their
PCs using their Microsoft account rather than a local or domain user.
Login methods In addition to using an account password, users can log into their Microsoft account by accepting a mobile notification sent to a mobile device with Microsoft Authenticator, a
FIDO2
security token or by using
Windows Hello. Users can also set up
two-factor authentication by getting a
time-based, single-use code by text, phone call or using an authenticator app.
Technical details Users' credentials are not checked by Microsoft account-enabled websites, but by a Microsoft account authentication server. A new user signing into a Microsoft account-enabled website is first redirected to the nearest authentication server, which asks for username and password over an
SSL connection. The user may select to have their computer remember their login: a newly signed-in user has an encrypted time-limited cookie stored on their computer and receives a
triple DES encrypted ID-tag that previously has been agreed upon between the authentication server and the Microsoft account-enabled website. This ID-tag is then sent to the website, upon which the website plants another encrypted HTTP cookie in the user's computer, also time-limited. As long as these cookies are valid, the user is not required to supply a username and password. If the user actively logs out of their Microsoft account, these cookies will be removed.
Relationship with work or school account Microsoft also offer a
work or school account which are set up by an
administrator as part of an organization. These accounts are separate from Microsoft accounts (which is also called
personal account) and cannot be merged, but may be used side-by-side by a user. A work or school account uses the
Azure Active Directory domain platform. ==History==